Arnaud 5a9e306357 fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit ...

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-12 19:05:20 +02:00

apps/web

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

cron

feat: batch-cook shopping list (already worked) + leftover expiry reminders

2026-07-12 10:03:52 +02:00

packages/db

feat: share shopping lists via a public link

2026-07-12 16:11:57 +02:00

traefik

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

.dockerignore

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

.env.example

feat: cooking history/gallery, unit conversion, nutrition diary, pantry scan, digest cron, nutrition-targeted meal plans

2026-07-10 08:06:28 +02:00

.gitignore

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

.npmrc

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

CHANGELOG.md

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

CLAUDE.md

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

compose.prod.yml

fix: photo thumbnails always used localhost:9000 in production

2026-07-12 13:53:15 +02:00

compose.yml

fix: MinIO CORS blocking browser uploads, changelog admin-only

2026-07-12 12:33:53 +02:00

DEPLOY.md

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

Dockerfile

fix: photo thumbnails always used localhost:9000 in production

2026-07-12 13:53:15 +02:00

HANDOFF.md

docs: resolve recipe-quota semantics decision in HANDOFF.md

2026-07-10 08:25:35 +02:00

package.json

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

pnpm-lock.yaml

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

pnpm-workspace.yaml

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

SECURITY_AUDIT.md

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

TODO.md

fix: resolve TODO.md security/perf/test-coverage backlog

2026-07-02 12:12:42 +02:00

tsconfig.base.json

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

S

Description

No description provided

12 MiB

Languages

TypeScript 99.2%

JavaScript 0.3%

CSS 0.2%

Dockerfile 0.2%